CVE-2021-33816

The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exec are blocked but backticks are not blocked.

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

3.94% chance of exploitation in the next 30 days, 90th percentile

Published

2021-11-10

Updated

2024-08-03

Proof-of-concept exploits (3)

• http://seclists.org/fulldisclosure/2021/Nov/39
• https://trovent.github.io/security-advisories/TRSA-2106-01/TRSA-2106-01.txt
• https://trovent.io/security-advisory-2106-01

Security advisories

• advisories/GHSA-vxr9-p2xw-m8cf

References

• CVE Record
• NVD entry